8.  Bells and whistles.

      brk(2) is actually not a very fast system call when you ask for storage. This is mainly because of the need by the kernel to zero the pages before handing them over, so therefore this implementation does not release heap pages until there is a large chunk to release back to the kernel. Chances are pretty good that we will need it again pretty soon anyway. Since these pages are not accessed at all, they will soon be paged out and don't affect anything but swap-space usage.

      The page directory is actually kept in a mmap(2)'ed piece of anonymous memory. This avoids some rather silly cases that would otherwise have to be handled when the page directory has to be extended.

      One particularly nice feature is that all pointers passed to free(3) and realloc(3) can be checked conclusively for validity: First the pointer is masked to find the page. The page directory is then examined, it must contain either MALLOC_FIRST, in which case the pointer must point exactly at the page, or it can contain a struct pginfo*, in which case the pointer must point to one of the chunks described by that structure. Warnings will be printed on stderr and nothing will be done with the pointer if it is found to be invalid.

      An environment variable MALLOC_OPTIONS allows the user some control over the behaviour of malloc. Some of the more interesting options are:

• Abort If malloc fails to allocate storage, core-dump the process with a message rather than expect it handle this correctly. It's amazing how few programs actually handle this condition correctly, and consequently the havoc they can create is the more creative or destructive.
• Dump Writes malloc statistics to a file called ``malloc.out'' prior to process termination.
• Hint Pass a hint to the kernel about pages we no longer need through the madvise(2) system call. This can help performance on machines that page heavily by eliminating unnecessary page-ins and page-outs of unused data.
• Realloc Always do a free and malloc when realloc(3) is called. For programs doing garbage collection using realloc(3), this make the heap collapse faster since malloc will reallocate from the lowest available address. The default is to leave things alone if the size of the allocation is still in the same size-class.
• Junk will explicitly fill the allocated area with a particular value to try to detect if programs rely on it being zero.
• Zero will explicitly zero out the allocated chunk of memory, while any space after the allocation in the chunk will be filled with the junk value to try to catch out of the chunk references.